Dependency Typosquatting
Typosquatting attacks publish malicious packages with names similar to popular legitimate packages (e.g., "lodash" vs "lodahs"). Developers who mistype package names during installation unknowingly install malware.
Overview
Typosquatting in package registries (npm, PyPI, RubyGems) is a growing attack vector. Attackers register packages with names similar to popular libraries -- using common typos, extra characters, or slight variations. When developers mistype a package name during installation, they unknowingly install malicious code that can steal credentials, install backdoors, or exfiltrate data.
Impact
Malware installation, credential theft, backdoor installation, supply chain compromise, data exfiltration.
Examples
Common Typosquats
lodash => lodahs, lodashs numpy => numppy, nunpy requests => reqeusts, request
Remediation
Verify package names carefully, use lockfiles, implement package signing verification, use private registries, and scan installed packages against known typosquatting lists.
Double-check package names before installation
Use lockfiles to pin exact dependency versions
Implement private package registries with curated packages
Run automated checks against known typosquatting databases
Verify package publishers and download counts
Related SuperClue scanner checks
These scanner checks look for signs of Dependency Typosquatting. What a scan can confirm from outside depends on your application.
Scan a domain you have verified with up to 350 modules, paid in credits.
See how website scanning works